---
title: "使用ZUUL作为鉴权网关"
categories:
- architecture
tags:
---

<div id="content">
<p>
<a href="https://stackoverflow.com/questions/37180375/using-zuul-as-an-authentication-gateway">https://stackoverflow.com/questions/37180375/using-zuul-as-an-authentication-gateway</a>
</p>
<div class="figure">
<p><img alt="viaL4.png" src="https://i.stack.imgur.com/viaL4.png"/>
</p>
</div>
<ol class="org-ol">
<li>客户端被引导至IDP（OpenID Connect/OAuth2）进行身份鉴定。</li>
<li>IDP返回access token（不透明的，不包含用户信息）</li>
<li>客户端使用access token通过API网关发送请求。</li>
<li>API网关带着access token请求IDP</li>
<li>IDP验证access token，然后返回用户信息给API网关</li>
<li>API网关以JWT的格式存储用户信息，JWT以Private key签名</li>
</ol>
<p>
API网关转发请求到后端服务需要带上JWT，后端服务器A请求服务器B也需要带上JWT。后端服务器使用Public key验证JWT的签名。
</p>
<p>
以Zuul作为API网关，如果API网关身份鉴定失败了，
You could try setting setSendZuulResponse(false) in the current context. This should not route the request. You could also call removeRouteHost() from the context, which would achieve the same. You could usesetResponseStatusCode to set the 401 status code.
</p>
<p>
ctx.setSendZuulResponse(false);
ctx.setResponseStatusCode(401);
</p>
</div>
<div class="status" id="postamble">
<p class="author">Author: amo</p>
<p class="validation"><a href="http://validator.w3.org/check?uri=referer">Validate</a></p>
</div>
